Next.js has shipped an out-of-band security update that closes two critical vulnerabilities allowing unauthenticated remote code execution. The flaws affect React Server Components and librsvg, the library used for SVG processing. A high-severity denial-of-service issue is also addressed in the same release.
The update, issued on October 14, is notable because the RCE flaws require no authentication, making them especially dangerous for exposed Next.js applications. Administrators and developers running self-hosted deployments are advised to apply the patch promptly.
Because the source is a single report, there are no conflicting accounts to compare. The details presented here reflect that report's description of the vulnerabilities and the vendor's out-of-band release.